Repository navigation
Disable AI memory for public URLs and embeds without external_user_id - #10043
Closed
nishantmonu51 wants to merge 2 commits into
Closed
nishantmonu51 wants to merge 2 commits into
nishantmonu51 wants to merge 2 commits into
Conversation
AI memory (#9992) is keyed on the runtime JWT subject and only treated an empty subject as anonymous. But the subject is shared by several viewers in two cases: an embed issued without external_user_id puts the issuer's identity (a service or user ID) on every viewer's token, and a public URL puts the magic token ID on everyone with the link. Viewers of the same embed or public URL therefore shared one memory store, so one viewer's "remember that..." silently shaped the answers of the others, and Manage memory let any viewer list, edit or delete the rest. Memory now needs a subject that identifies one viewer: - The admin server marks magic auth token JWTs with the attribute public_url, since they carry the creator's attributes and were otherwise indistinguishable from the creator's own token, and marks tokens issued with an external_user_id with external_user. Embed tokens already carry embed: true. - ResolveFeatureFlags resolves chat_memory to false for public URLs and for embeds without external_user, whatever the project configures. MemoryAvailable (the memory RPCs and the update_memory tool) enforces that flag, and GetInstance returns it to the UI, which already hides the memory button and Settings > AI memory, and now the "Memory updated" notice, when it is off. - Docs state that memory is per user, available in embeds only with external_user_id, and never through public URLs. Tests cover service-token, external-user and public URL claims in the runtime, and the JWT attributes issued for service-token embeds with and without an external user ID and for a public URL in the admin server.
…er-side
A service token used directly (GetProject, GetDeploymentCredentials) has the service ID as subject, shared by every caller, so it now carries service: true and memory is off unless an external_user_id is set.
The service, public_url and external_user markers are stripped from stored and caller-supplied attributes before being set, so attributes: {external_user: true} cannot turn memory on for a shared subject.
Member
|
closed in favour of #10046 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI chat memory (#9992) is keyed on the runtime JWT subject, but
ai.MemoryAvailableonly treated an empty subject as anonymous. Three token types put a shared ID in the subject, so every viewer read and wrote the same memory store:external_user_id(the documented default): the subject is the service or user ID of the token that calledGetIFrame, shared by every viewer of the embed.GetProject,GetDeploymentCredentialswithoutexternal_user_id): the subject is the service ID, shared by every caller.Changes:
admin/server/runtime_jwt.go: magic-token JWTs carrypublic_url: true, service-owner JWTs carryservice: true, and tokens issued with anexternal_user_idcarryexternal_user: true. The markers are derived at issuance and stripped from stored or caller-supplied attributes, soattributes: {external_user: true}cannot turn memory on for a shared subject.runtime/feature_flags.go:ResolveFeatureFlagsforceschat_memoryto false whenpublic_url || ((embed || service) && !external_user), whatever the project configures. The runtime enforces it viaai.MemoryAvailable(RPCs and theupdate_memorytool) and the UI hides the memory controls when the flag is off.external_user_idkeep memory: their subject is per viewer.MemoryUpdateChip.svelteis hidden when memory is off, so an older conversation never links to a memory manager the runtime refuses to serve.chat_memoryflag.Tests: feature flag resolution per principal type,
ai.MemoryAvailablegates, memory RPCs for service, embed, public URL and external user claims, and the admin JWT test asserts the markers for service tokens,GetIFramewith and withoutexternal_user_id, spoofed custom attributes, and magic tokens.Not covered: "View as" (an admin viewing as another user reads that user's memories) is unchanged.
Affects 0.91 only (memory shipped after the 0.90 cut). Intended for cherry-pick into
release-0.91.Checklist: